Splunk Search

supported platforms

jrosenmayer
New Member

Hi,

is the Windows App supported on Splunk installed on Linux ? When I go for example to section Windows -> Event Log Collections I get a message "In handler 'win-event-log-collections': Admin handler 'win-event-log-collections' not found.". There is no link to create a new "source".

regards

Jiri

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The Windows app will partially work:

  • The reports and queries and searches my be run on a Linux search head or Linux indexer, and will display results correctly, provided the data is in the queried index.
  • The Windows-specific data inputs (WinEventLog, WMI, Registry) will not run on Linux. The inputs must be run on a Windows machine to collect the data. This data may be forwarded to an indexer that runs on any platform (and reported on from any platform.)

In your case, it appears you are trying to configure inputs on a Linux machine, so this won't work.

simuvid
Splunk Employee
Splunk Employee

Hi there,

the Splunk for Windows App will not work on a Linux machine.

Reason is that Splunk is using the Windows Event Manager interface to collect Windows data, like WMI and Event logs.

Linux does not have this feature.

See folowing documentation:

http://www.splunk.com/base/Documentation/4.1.4/Admin/MonitorWindowsdata

Hope that helps?

Cheers,

simuvid

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...